Microsoft organizational changes seek to address security failures

The company says securing its products is its top priority after a series of damaging, embarrassing breaches. 

Microsoft said it will tie compensation for some senior executives to hitting security targets and that it will prioritize security in its products over shipping new features, in what is the company’s latest bid to address a string of recent breaches that have raised concerns that its software has become an easy target for hackers. 

The changes announced Friday are the latest update to what Microsoft calls its “Secure the Future Initiative,” which seeks to shift engineering resources toward security. In a blog post, Charlie Bell, Microsoft’s executive vice president for security, said that “Microsoft plays a central role in the world’s digital ecosystem” and that the company “must and will do more” to secure its products. “We are making security our top priority at Microsoft, above all else,” he wrote. 

In an email to staff Friday, Microsoft CEO Satya Nadella said that security is every employee’s top responsibility and that going forward the company will prioritize security ahead of shipping new features for products, according to a source at the company. 

Friday’s announcement comes on the heels of a scathing report by the Cyber Safety Review Board examining a breach of the company by Chinese hackers. That report blamed the incident on a series of “operational and strategic decisions that collectively point to a corporate culture that deprioritized both enterprise security investments and rigorous risk management.”

Since that incident, in which Chinese hackers stole a highly sensitive signing key and used it to spy on senior U.S. government officials, Microsoft has disclosed another embarrassing incident, this time involving Russian hackers that accessed company source code and emails belonging to senior executives. Last month, CyberScoop reported that the pilfered emails included messages between Microsoft and U.S. federal agencies. 

Microsoft has said it faces ever-more sophisticated threats and that well-resourced attackers sponsored by nation states have made attacking the company a priority. While these groups are difficult to defend against, repeated breaches by Russian and Chinese hackers have caused concern in Washington that Microsoft, which is a crucial provider of IT services to the federal government, is failing to adequately invest in security measures and that the company has become a threat to national security. 

Friday’s organizational overhauls appear aimed at addressing this criticism. According to the Microsoft blog post, the company is putting in place a series of governance changes to elevate the importance of security at the company, including partnering deputy chief information security officers with engineering teams. 

The company has identified six security priorities to guide its work going forward, including better protecting identities and secrets and better protecting tenant accounts and isolating production systems. Microsoft executives will be meeting weekly to assess the execution of these priorities, according to Bell. 

“Microsoft runs on trust and this trust must be earned and maintained,” Bell wrote. “This is job #1 for us.”

A bold new strategy or a dangerous precedent? Experts are divided on Trump’s memo.

The “philosophical shift” that the memo authorizes raises legal, practical and moral questions, experts say.

Microsoft, tech companies throw weight behind spread of open-source AI

Where’s the Trump administration line on AI regulation?

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure